GHSA-8vx9-hcvq-gfv8MediumCVSS 4.7

MantisBT XSS through weak CSP when using Gravatar plugin

Published
May 17, 2022
Last Modified
June 11, 2025

🔗 CVE IDs covered (1)

CVE-2016-7111 →

📋 Description

MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

🎯 Affected products2

  • composer/mantisbt/mantisbt:<= 1.3.0
  • composer/mantisbt/mantisbt:= 2.0.0-beta.1

🔗 References (6)